Merge staging-next into staging

2022-01-08 12:01:36 +00:00 · 2022-01-08 12:01:36 +00:00 · cf7efe1192
commit cf7efe1192
parent 09634364bc c1fac0a1c0
109 changed files with 1150 additions and 541 deletions
--- a/doc/builders/special/mkshell.section.md
+++ b/doc/builders/special/mkshell.section.md
@ -1,17 +1,37 @@
 # pkgs.mkShell {#sec-pkgs-mkShell}

-`pkgs.mkShell` is a special kind of derivation that is only useful when using
-it combined with `nix-shell`. It will in fact fail to instantiate when invoked
-with `nix-build`.
+`pkgs.mkShell` is a specialized `stdenv.mkDerivation` that removes some
+repetition when using it with `nix-shell` (or `nix develop`).

 ## Usage {#sec-pkgs-mkShell-usage}

+Here is a common usage example:
+
 ```nix
 { pkgs ? import <nixpkgs> {} }:
 pkgs.mkShell {
-  # specify which packages to add to the shell environment
  packages = [ pkgs.gnumake ];
-  # add all the dependencies, of the given packages, to the shell environment
-  inputsFrom = with pkgs; [ hello gnutar ];
+
+  inputsFrom = [ pkgs.hello pkgs.gnutar ];
+
+  shellHook = ''
+    export DEBUG=1
+  '';
 }
 ```
+
+## Attributes
+
+* `name` (default: `nix-shell`). Set the name of the derivation.
+* `packages` (default: `[]`). Add executable packages to the `nix-shell` environment.
+* `inputsFrom` (default: `[]`). Add build dependencies of the listed derivations to the `nix-shell` environment.
+* `shellHook` (default: `""`). Bash statements that are executed by `nix-shell`.
+
+... all the attributes of `stdenv.mkDerivation`.
+
+## Building the shell
+
+This derivation output will contain a text file that contains a reference to
+all the build inputs. This is useful in CI where we want to make sure that
+every derivation, and its dependencies, build properly. Or when creating a GC
+root so that the build dependencies don't get garbage-collected.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3188,6 +3188,12 @@
    githubId = 24791219;
    name = "Jakob Neufeld";
  };
+  dsalaza4 = {
+    email = "podany270895@gmail.com";
+    github = "dsalaza4";
+    githubId = 11205987;
+    name = "Daniel Salazar";
+  };
  dschrempf = {
    name = "Dominik Schrempf";
    email = "dominik.schrempf@gmail.com";
@ -6049,6 +6055,13 @@
    github = "k4leg";
    githubId = 39882583;
  };
+  k900 = {
+    name = "Ilya K.";
+    email = "me@0upti.me";
+    github = "K900";
+    githubId = 386765;
+    matrix = "@k900:0upti.me";
+  };
  kaction = {
    name = "Dmitry Bogatov";
    email = "KAction@disroot.org";
--- a/nixos/modules/installer/sd-card/sd-image-riscv64-qemu.nix
+++ b/nixos/modules/installer/sd-card/sd-image-riscv64-qemu.nix
@ -0,0 +1,32 @@
+# To build, use:
+# nix-build nixos -I nixos-config=nixos/modules/installer/sd-card/sd-image-riscv64-qemu.nix -A config.system.build.sdImage
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../../profiles/base.nix
+    ./sd-image.nix
+  ];
+
+  boot.loader = {
+    grub.enable = false;
+    generic-extlinux-compatible = {
+      enable = true;
+
+      # Don't even specify FDTDIR - We do not have the correct DT
+      # The DTB is generated by QEMU at runtime
+      useGenerationDeviceTree = false;
+    };
+  };
+
+  boot.consoleLogLevel = lib.mkDefault 7;
+  boot.kernelParams = [ "console=tty0" "console=ttyS0,115200n8" ];
+
+  sdImage = {
+    populateFirmwareCommands = "";
+    populateRootCommands = ''
+      mkdir -p ./files/boot
+      ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
+    '';
+  };
+}
--- a/nixos/modules/installer/sd-card/sd-image-x86_64.nix
+++ b/nixos/modules/installer/sd-card/sd-image-x86_64.nix
@ -0,0 +1,27 @@
+# To build, use:
+# nix-build nixos -I nixos-config=nixos/modules/installer/sd-card/sd-image-x86_64.nix -A config.system.build.sdImage
+
+# This image is primarily used in NixOS tests (boot.nix) to test `boot.loader.generic-extlinux-compatible`.
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../../profiles/base.nix
+    ./sd-image.nix
+  ];
+
+  boot.loader = {
+    grub.enable = false;
+    generic-extlinux-compatible.enable = true;
+  };
+
+  boot.consoleLogLevel = lib.mkDefault 7;
+
+  sdImage = {
+    populateFirmwareCommands = "";
+    populateRootCommands = ''
+      mkdir -p ./files/boot
+      ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot
+    '';
+  };
+}
--- a/nixos/modules/installer/sd-card/sd-image.nix
+++ b/nixos/modules/installer/sd-card/sd-image.nix
@ -176,7 +176,7 @@ in

      nativeBuildInputs = [ dosfstools e2fsprogs mtools libfaketime util-linux zstd ];

-      inherit (config.sdImage) compressImage;
+      inherit (config.sdImage) imageName compressImage;

      buildCommand = ''
        mkdir -p $out/nix-support $out/sd-image
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -364,6 +364,7 @@
  ./services/desktops/malcontent.nix
  ./services/desktops/pipewire/pipewire.nix
  ./services/desktops/pipewire/pipewire-media-session.nix
+  ./services/desktops/pipewire/wireplumber.nix
  ./services/desktops/gnome/at-spi2-core.nix
  ./services/desktops/gnome/chrome-gnome-shell.nix
  ./services/desktops/gnome/evolution-data-server.nix
--- a/nixos/modules/profiles/all-hardware.nix
+++ b/nixos/modules/profiles/all-hardware.nix
@ -44,12 +44,12 @@ in
      "ohci1394" "sbp2"

      # Virtio (QEMU, KVM etc.) support.
-      "virtio_net" "virtio_pci" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console"
+      "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console"

      # VMware support.
      "mptspi" "vmxnet3" "vsock"
    ] ++ lib.optional platform.isx86 "vmw_balloon"
-    ++ lib.optionals (!platform.isAarch64 && !platform.isAarch32) [ # not sure where else they're missing
+    ++ lib.optionals (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) [
      "vmw_vmci" "vmwgfx" "vmw_vsock_vmci_transport"

      # Hyper-V support.
--- a/nixos/modules/services/cluster/kubernetes/addon-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
@ -167,4 +167,5 @@ in
    };
  };

+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/addons/dns.nix
+++ b/nixos/modules/services/cluster/kubernetes/addons/dns.nix
@ -363,4 +363,6 @@ in {

    services.kubernetes.kubelet.clusterDns = mkDefault cfg.clusterIp;
  };
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/apiserver.nix
+++ b/nixos/modules/services/cluster/kubernetes/apiserver.nix
@ -496,4 +496,5 @@ in

  ];

+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/controller-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
@ -6,7 +6,6 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.controllerManager;
-  klib = options.services.kubernetes.lib.default;
 in
 {
  imports = [
@ -57,7 +56,7 @@ in
      type = int;
    };

-    kubeconfig = klib.mkKubeConfigOptions "Kubernetes controller manager";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes controller manager";

    leaderElect = mkOption {
      description = "Whether to start leader election before executing main loop.";
@ -130,7 +129,7 @@ in
            "--cluster-cidr=${cfg.clusterCidr}"} \
          ${optionalString (cfg.featureGates != [])
            "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${klib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
          --leader-elect=${boolToString cfg.leaderElect} \
          ${optionalString (cfg.rootCaFile!=null)
            "--root-ca-file=${cfg.rootCaFile}"} \
@ -157,7 +156,7 @@ in
      path = top.path;
    };

-    services.kubernetes.pki.certs = with klib; {
+    services.kubernetes.pki.certs = with top.lib; {
      controllerManager = mkCert {
        name = "kube-controller-manager";
        CN = "kube-controller-manager";
@ -172,4 +171,6 @@ in

    services.kubernetes.controllerManager.kubeconfig.server = mkDefault top.apiserverAddress;
  };
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -26,10 +26,7 @@ let

      containerd.runtimes.runc = {
        runtime_type = "io.containerd.runc.v2";
-      };
-
-      containerd.runtimes."io.containerd.runc.v2".options = {
-        SystemdCgroup = true;
+        options.SystemdCgroup = true;
      };
    };
  };
@ -193,8 +190,6 @@ in {
        inherit mkKubeConfigOptions;
      };
      type = types.attrs;
-      readOnly = true;
-      internal = true;
    };

    secretsPath = mkOption {
@ -315,4 +310,6 @@ in {
                          else "${cfg.masterAddress}:${toString cfg.apiserver.securePort}"}");
    })
  ];
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/flannel.nix
+++ b/nixos/modules/services/cluster/kubernetes/flannel.nix
@ -95,4 +95,6 @@ in

    };
  };
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@ -6,7 +6,6 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.kubelet;
-  klib = options.services.kubernetes.lib.default;

  cniConfig =
    if cfg.cni.config != [] && cfg.cni.configDir != null then
@ -28,7 +27,7 @@ let
    config.Cmd = ["/bin/pause"];
  };

-  kubeconfig = klib.mkKubeConfig "kubelet" cfg.kubeconfig;
+  kubeconfig = top.lib.mkKubeConfig "kubelet" cfg.kubeconfig;

  manifestPath = "kubernetes/manifests";

@ -178,7 +177,7 @@ in
      type = str;
    };

-    kubeconfig = klib.mkKubeConfigOptions "Kubelet";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubelet";

    manifests = mkOption {
      description = "List of manifests to bootstrap with kubelet (only pods can be created as manifest entry)";
@ -265,8 +264,6 @@ in
        "net.bridge.bridge-nf-call-ip6tables" = 1;
      };

-      systemd.enableUnifiedCgroupHierarchy = false; # true breaks node memory metrics
-
      systemd.services.kubelet = {
        description = "Kubernetes Kubelet Service";
        wantedBy = [ "kubernetes.target" ];
@ -359,7 +356,7 @@ in
      services.kubernetes.kubelet.hostname = with config.networking;
        mkDefault (hostName + optionalString (domain != null) ".${domain}");

-      services.kubernetes.pki.certs = with klib; {
+      services.kubernetes.pki.certs = with top.lib; {
        kubelet = mkCert {
          name = "kubelet";
          CN = top.kubelet.hostname;
@ -396,4 +393,6 @@ in
    })

  ];
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@ -1,11 +1,10 @@
-{ config, options, lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:

 with lib;

 let
  top = config.services.kubernetes;
  cfg = top.pki;
-  klib = options.services.kubernetes.lib;

  csrCA = pkgs.writeText "kube-pki-cacert-csr.json" (builtins.toJSON {
    key = {
@ -30,7 +29,7 @@ let
  cfsslAPITokenLength = 32;

  clusterAdminKubeconfig = with cfg.certs.clusterAdmin;
-    klib.mkKubeConfig "cluster-admin" {
+    top.lib.mkKubeConfig "cluster-admin" {
        server = top.apiserverAddress;
        certFile = cert;
        keyFile = key;
@ -251,7 +250,7 @@ in
      # - it would be better with a more Nix-oriented way of managing addons
      systemd.services.kube-addon-manager = mkIf top.addonManager.enable (mkMerge [{
        environment.KUBECONFIG = with cfg.certs.addonManager;
-          klib.mkKubeConfig "addon-manager" {
+          top.lib.mkKubeConfig "addon-manager" {
            server = top.apiserverAddress;
            certFile = cert;
            keyFile = key;
@ -344,7 +343,7 @@ in
      '';

      services.flannel = with cfg.certs.flannelClient; {
-        kubeconfig = klib.mkKubeConfig "flannel" {
+        kubeconfig = top.lib.mkKubeConfig "flannel" {
          server = top.apiserverAddress;
          certFile = cert;
          keyFile = key;
@ -402,4 +401,6 @@ in
        };
      };
    });
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@ -6,7 +6,6 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.proxy;
-  klib = options.services.kubernetes.lib.default;
 in
 {
  imports = [
@ -44,7 +43,7 @@ in
      type = str;
    };

-    kubeconfig = klib.mkKubeConfigOptions "Kubernetes proxy";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";

    verbosity = mkOption {
      description = ''
@ -73,7 +72,7 @@ in
          ${optionalString (cfg.featureGates != [])
            "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
          --hostname-override=${cfg.hostname} \
-          --kubeconfig=${klib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
          ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
          ${cfg.extraOpts}
        '';
@ -89,7 +88,7 @@ in
    services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;

    services.kubernetes.pki.certs = {
-      kubeProxyClient = klib.mkCert {
+      kubeProxyClient = top.lib.mkCert {
        name = "kube-proxy-client";
        CN = "system:kube-proxy";
        action = "systemctl restart kube-proxy.service";
@ -98,4 +97,6 @@ in

    services.kubernetes.proxy.kubeconfig.server = mkDefault top.apiserverAddress;
  };
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/cluster/kubernetes/scheduler.nix
+++ b/nixos/modules/services/cluster/kubernetes/scheduler.nix
@ -6,7 +6,6 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.scheduler;
-  klib = options.services.kubernetes.lib.default;
 in
 {
  ###### interface
@ -33,7 +32,7 @@ in
      type = listOf str;
    };

-    kubeconfig = klib.mkKubeConfigOptions "Kubernetes scheduler";
+    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes scheduler";

    leaderElect = mkOption {
      description = "Whether to start leader election before executing main loop.";
@ -70,7 +69,7 @@ in
          --address=${cfg.address} \
          ${optionalString (cfg.featureGates != [])
            "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${klib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
          --leader-elect=${boolToString cfg.leaderElect} \
          --port=${toString cfg.port} \
          ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
@ -88,7 +87,7 @@ in
    };

    services.kubernetes.pki.certs = {
-      schedulerClient = klib.mkCert {
+      schedulerClient = top.lib.mkCert {
        name = "kube-scheduler-client";
        CN = "system:kube-scheduler";
        action = "systemctl restart kube-scheduler.service";
@ -97,4 +96,6 @@ in

    services.kubernetes.scheduler.kubeconfig.server = mkDefault top.apiserverAddress;
  };
+
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-settings-daemon.nix
@ -57,26 +57,12 @@ in
      pkgs.gnome.gnome-settings-daemon
    ];

-    systemd.user.targets."gnome-session-initialized".wants = [
-      "gsd-color.target"
-      "gsd-datetime.target"
-      "gsd-keyboard.target"
-      "gsd-media-keys.target"
-      "gsd-print-notifications.target"
-      "gsd-rfkill.target"
-      "gsd-screensaver-proxy.target"
-      "gsd-sharing.target"
-      "gsd-smartcard.target"
-      "gsd-sound.target"
-      "gsd-wacom.target"
-      "gsd-wwan.target"
-      "gsd-a11y-settings.target"
-      "gsd-housekeeping.target"
-      "gsd-power.target"
+    systemd.user.targets."gnome-session-x11-services".wants = [
+      "org.gnome.SettingsDaemon.XSettings.service"
    ];

-    systemd.user.targets."gnome-session-x11-services".wants = [
-      "gsd-xsettings.target"
+    systemd.user.targets."gnome-session-x11-services-ready".wants = [
+      "org.gnome.SettingsDaemon.XSettings.service"
    ];

  };
--- a/nixos/modules/services/desktops/pipewire/wireplumber.nix
+++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix
@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.pipewire.wireplumber;
+in
+{
+  meta.maintainers = [ lib.maintainers.k900 ];
+
+  options = {
+    services.pipewire.wireplumber = {
+      enable = lib.mkEnableOption "A modular session / policy manager for PipeWire";
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.wireplumber;
+        defaultText = lib.literalExpression "pkgs.wireplumber";
+        description = ''
+          The wireplumber derivation to use.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !config.services.pipewire.media-session.enable;
+        message = "WirePlumber and pipewire-media-session can't be enabled at the same time.";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+
+    systemd.services.wireplumber.enable = config.services.pipewire.systemWide;
+    systemd.user.services.wireplumber.enable = !config.services.pipewire.systemWide;
+
+    systemd.services.wireplumber.wantedBy = [ "pipewire.service" ];
+    systemd.user.services.wireplumber.wantedBy = [ "pipewire.service" ];
+  };
+}
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
@ -30,6 +30,21 @@ in
        '';
      };

+      useGenerationDeviceTree = mkOption {
+        default = true;
+        type = types.bool;
+        description = ''
+          Whether to generate Device Tree-related directives in the
+          extlinux configuration.
+
+          When enabled, the bootloader will attempt to load the device
+          tree binaries from the generation's kernel.
+
+          Note that this affects all generations, regardless of the
+          setting value used in their configurations.
+        '';
+      };
+
      configurationLimit = mkOption {
        default = 20;
        example = 10;
@ -54,7 +69,9 @@ in
  };

  config = let
-    builderArgs = "-g ${toString cfg.configurationLimit} -t ${timeoutStr}" + lib.optionalString (dtCfg.name != null) " -n ${dtCfg.name}";
+    builderArgs = "-g ${toString cfg.configurationLimit} -t ${timeoutStr}"
+      + lib.optionalString (dtCfg.name != null) " -n ${dtCfg.name}"
+      + lib.optionalString (!cfg.useGenerationDeviceTree) " -r";
  in
    mkIf cfg.enable {
      system.build.installBootLoader = "${builder} ${builderArgs} -c";
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh
@ -6,7 +6,7 @@ export PATH=/empty
 for i in @path@; do PATH=$PATH:$i/bin; done

 usage() {
-    echo "usage: $0 -t <timeout> -c <path-to-default-configuration> [-d <boot-dir>] [-g <num-generations>] [-n <dtbName>]" >&2
+    echo "usage: $0 -t <timeout> -c <path-to-default-configuration> [-d <boot-dir>] [-g <num-generations>] [-n <dtbName>] [-r]" >&2
    exit 1
 }

@ -15,7 +15,7 @@ default=                # Default configuration
 target=/boot            # Target directory
 numGenerations=0        # Number of other generations to include in the menu

-while getopts "t:c:d:g:n:" opt; do
+while getopts "t:c:d:g:n:r" opt; do
    case "$opt" in
        t) # U-Boot interprets '0' as infinite and negative as instant boot
            if [ "$OPTARG" -lt 0 ]; then
@ -30,6 +30,7 @@ while getopts "t:c:d:g:n:" opt; do
        d) target="$OPTARG" ;;
        g) numGenerations="$OPTARG" ;;
        n) dtbName="$OPTARG" ;;
+        r) noDeviceTree=1 ;;
        \?) usage ;;
    esac
 done
@ -96,6 +97,12 @@ addEntry() {
    fi
    echo "  LINUX ../nixos/$(basename $kernel)"
    echo "  INITRD ../nixos/$(basename $initrd)"
+    echo "  APPEND init=$path/init $extraParams"
+
+    if [ -n "$noDeviceTree" ]; then
+        return
+    fi
+
    if [ -d "$dtbDir" ]; then
        # if a dtbName was specified explicitly, use that, else use FDTDIR
        if [ -n "$dtbName" ]; then
@ -109,7 +116,6 @@ addEntry() {
            exit 1
        fi
    fi
-    echo "  APPEND init=$path/init $extraParams"
 }

 tmpFile="$target/extlinux/extlinux.conf.tmp.$$"
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@ -12,12 +12,22 @@ let
  iso =
    (import ../lib/eval-config.nix {
      inherit system;
-      modules =
-        [ ../modules/installer/cd-dvd/installation-cd-minimal.nix
-          ../modules/testing/test-instrumentation.nix
-        ];
+      modules = [
+        ../modules/installer/cd-dvd/installation-cd-minimal.nix
+        ../modules/testing/test-instrumentation.nix
+      ];
    }).config.system.build.isoImage;

+  sd =
+    (import ../lib/eval-config.nix {
+      inherit system;
+      modules = [
+        ../modules/installer/sd-card/sd-image-x86_64.nix
+        ../modules/testing/test-instrumentation.nix
+        { sdImage.compressImage = false; }
+      ];
+    }).config.system.build.sdImage;
+
  pythonDict = params: "\n    {\n        ${concatStringsSep ",\n        " (mapAttrsToList (name: param: "\"${name}\": \"${param}\"") params)},\n    }\n";

  makeBootTest = name: extraConfig:
@ -110,4 +120,30 @@ in {
    };

    biosNetboot = makeNetbootTest "bios" {};
+
+    ubootExtlinux = let
+      sdImage = "${sd}/sd-image/${sd.imageName}";
+      mutableImage = "/tmp/linked-image.qcow2";
+
+      machineConfig = pythonDict {
+        bios = "${pkgs.ubootQemuX86}/u-boot.rom";
+        qemuFlags = "-m 768 -machine type=pc,accel=tcg -drive file=${mutableImage},if=ide,format=qcow2";
+      };
+    in makeTest {
+      name = "boot-uboot-extlinux";
+      nodes = { };
+      testScript = ''
+        import os
+
+        # Create a mutable linked image backed by the read-only SD image
+        if os.system("qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
+            raise RuntimeError("Could not create mutable linked image")
+
+        machine = create_machine(${machineConfig})
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+        machine.succeed("nix store verify -r --no-trust --option experimental-features nix-command /run/current-system")
+        machine.shutdown()
+      '';
+    };
 }
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@ -60,13 +60,6 @@ let
                  advertiseAddress = master.ip;
                };
                masterAddress = "${masterName}.${config.networking.domain}";
-                # workaround for:
-                #   https://github.com/kubernetes/kubernetes/issues/102676
-                #   (workaround from) https://github.com/kubernetes/kubernetes/issues/95488
-                kubelet.extraOpts = ''\
-                  --cgroups-per-qos=false \
-                  --enforce-node-allocatable="" \
-                '';
              };
            }
            (optionalAttrs (any (role: role == "master") machine.roles) {
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@ -9,16 +9,16 @@ let

 in buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.10.14";
+  version = "1.10.15";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-0DQrcei3FM+X4BYokou7dPNVCcJTbY05YsTvzdtsas8=";
+    sha256 = "0f6n9rg42ph47mvykc9f0lf99yzwqy4jm7mlzyks4l6i6fl1g3q1";
  };

-  vendorSha256 = "sha256-zQOpWtQrdn+E1tRWmtEScQ7DDMzNCSr5H+5YL+Z1vug=";
+  vendorSha256 = "1s5yfpk2yn7f3zwjl2fdrh6c63ki2b8rlmnlss27yxibsidaj0yd";

  doCheck = false;

--- a/pkgs/applications/editors/emacs/elisp-packages/ess-R-object-popup/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/ess-R-object-popup/default.nix
@ -2,6 +2,8 @@
 , trivialBuild
 , fetchFromGitHub
 , emacs
+, popup
+, ess
 }:

 trivialBuild rec {
@ -15,6 +17,11 @@ trivialBuild rec {
    hash = "sha256-YN8ZLXEbwTFdFfovkV2IXV9v6y/PTgCdiRQqbpRaF2E=";
  };

+  packageRequires = [
+    popup
+    ess
+  ];
+
  meta = {
    homepage = "https://github.com/myuhe/ess-R-object-popup.el";
    description = "Popup descriptions of R objects";
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@ -225,8 +225,6 @@
    };
  };

-  railgun = callPackage ./railgun { };
-
  structured-haskell-mode = self.shm;

  sv-kalender = callPackage ./sv-kalender { };
--- a/pkgs/applications/editors/emacs/elisp-packages/railgun/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/railgun/default.nix
@ -1,25 +0,0 @@
-{ lib
-, trivialBuild
-, fetchFromGitHub
-, emacs
-}:
-
-trivialBuild {
-  pname = "railgun";
-  version= "0.pre+unstable=2012-10-17";
-
-  src = fetchFromGitHub {
-    owner = "mbriggs";
-    repo = "railgun.el";
-    rev = "66aaa1b091baef53a69d0d7425f48d184b865fb8";
-    hash = "sha256-0L+jFgrXEPMTptx53RDdyH4BiA+7uInHceXL0eROoAM=";
-  };
-
-  buildInputs = [ emacs ];
-
-  meta = with lib; {
-    homepage = "https://github.com/mbriggs/railgun.el";
-    description = "Propel yourself through a rails project with the power of magnets";
-    inherit (emacs.meta) platforms;
-  };
-}
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@ -7,11 +7,11 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "feh";
-  version = "3.7.2";
+  version = "3.8";

  src = fetchurl {
    url = "https://feh.finalrewind.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-hHGP0nIM9UDSRXaElP4OtOWY9Es54jJrrow2ioKcglg=";
+    sha256 = "1a9bsq5j9sl2drzkab0hdhnamalpaszw9mz2prz6scrr5dak8g3z";
  };

  outputs = [ "out" "man" "doc" ];
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -3,20 +3,20 @@
 }:
 let
  pname = "josm";
-  version = "18303";
+  version = "18360";
  srcs = {
    jar = fetchurl {
      url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "sha256-+gUJsx238iQKrYx/rdtd8ESVXI0u/kW2s0p33T4MSWU=";
+      sha256 = "sha256-1OMEPMtUGkxQCgpmyVP1h25gSDa2MKF7l1rodr61O5s=";
    };
    macosx = fetchurl {
      url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java17.zip";
-      sha256 = "sha256-s8MuXcDl+DwjXOtf6ltpxYSeCE9R2/x9iJs2BoZHgXM=";
+      sha256 = "sha256-ZCybgaLwPfQVG2gJ+dtElIY7bGZUe9R8a/0B6QK8yK8=";
    };
    pkg = fetchsvn {
      url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
      rev = version;
-      sha256 = "sha256-+zsbksfQPwzVPpKlXdRWachWwjVuhExlyiEKDMkaxp8=";
+      sha256 = "sha256-GbIWZTJmmUT8r9L63/6mcnRt7dvavqGAVbozxlbF89g=";
    };
  };
 in
--- a/pkgs/applications/misc/obinskit/default.nix
+++ b/pkgs/applications/misc/obinskit/default.nix
@ -4,7 +4,7 @@
 , libxkbcommon
 , systemd
 , xorg
-, electron_11
+, electron_13
 , makeWrapper
 , makeDesktopItem
 }:
@ -17,15 +17,15 @@ let
    genericName = "Obinskit keyboard configurator";
    categories = "Utility";
  };
-  electron = electron_11;
+  electron = electron_13;
 in
 stdenv.mkDerivation rec {
  pname = "obinskit";
-  version = "1.1.8";
+  version = "1.2.11";

  src = fetchurl {
-    url = "http://releases.obins.net/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
-    sha256 = "MgasbgexOdscQrUte/6OzCSrc74RvaBq44oHplQA/Gc=";
+    url = "https://s3.hexcore.xyz/occ/linux/tar/ObinsKit_${version}_x64.tar.gz";
+    sha256 = "1kcn41wmwcx6q70spa9a1qh7wfrj1sk4v4i58lbnf9kc6vasw41a";
  };

  unpackPhase = "tar -xzf $src";
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@ -31,11 +31,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "obsidian";
-  version = "0.13.14";
+  version = "0.13.19";

  src = fetchurl {
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/obsidian-${version}.tar.gz";
-    sha256 = "0d55lk643yqjz4s6j5lbrdkf9f7wmwlz9ahjx760rzqpzy5190nr";
+    sha256 = "1jx1raynr0dgffqwya7cp4yr3szdn9bfwrhzk09bkmn8ys7d426r";
  };

  nativeBuildInputs = [ makeWrapper graphicsmagick ];
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -45,19 +45,19 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "96.0.4664.110",
-    "sha256": "1s3ilq0ik36qgqp7l88gfd1yx97zscn8yr2kprsrjfp9q8lrva9n",
-    "sha256bin64": "17cyj1jx47fz6y26f196xhlngrw5gnjgcvapvgkgswlwd7y67jcb",
+    "version": "97.0.4692.71",
+    "sha256": "0z7ximvm4a78kxyp4j0i2jzklxazpw6jcqi9jkaf8bvq9ga8kqca",
+    "sha256bin64": "1z1d50i5pvqaw6hjdxwasbznzgqwrnd1z8jmy2x05b6i49vd7r9j",
    "deps": {
      "gn": {
-        "version": "2021-09-24",
+        "version": "2021-11-03",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "0153d369bbccc908f4da4993b1ba82728055926a",
-        "sha256": "0y4414h8jqsbz5af6pn91c0vkfp4s281s85g992xfyl785c5zbsi"
+        "rev": "90294ccdcf9334ed25a76ac9b67689468e506342",
+        "sha256": "0n0jml8s00ayy186jzrf207hbz70pxiq426znxwxd4gjcp60scsa"
      },
      "ungoogled-patches": {
-        "rev": "96.0.4664.110-1",
-        "sha256": "098mfcd1lr2hhlic0i1l5gxsq71axvqnn4gayr4r9j6nbj9byf4h"
+        "rev": "97.0.4692.71-1",
+        "sha256": "0a1172kj93lg3ip4im1s5s7bdm2q41w4m6ylyxc92w29rbhbxjxp"
      }
    }
  }
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -3,6 +3,8 @@
 , fetchFromGitHub
 , callPackage
 , config
+
+, cdrtools # libvirt
 }:
 let
  list = lib.importJSON ./providers.json;
@ -41,7 +43,9 @@ let
  special-providers = let archived = throw "the provider has been archived by upstream"; in {
    # Packages that don't fit the default model
    gandi = callPackage ./gandi { };
-    libvirt = callPackage ./libvirt { };
+    # mkisofs needed to create ISOs holding cloud-init data,
+    # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
+    libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
    teleport = callPackage ./teleport { };
    vpsadmin = callPackage ./vpsadmin { };
  } // (lib.optionalAttrs (config.allowAliases or false) {
--- a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
@ -1,56 +0,0 @@
-{ buildGoModule, cdrtools, fetchFromGitHub, lib, libvirt, makeWrapper, pkg-config }:
-
-# USAGE:
-# install the following package globally or in nix-shell:
-#
-#   (terraform.withPlugins (p: [p.libvirt]))
-#
-# configuration.nix:
-#
-#   virtualisation.libvirtd.enable = true;
-#
-# pick an example from (i.e ubuntu):
-# https://github.com/dmacvicar/terraform-provider-libvirt/tree/main/examples
-
-let
-  sha256 = "sha256-1l+ARrXHxtSdnQfYV/6gw3BYHVH8NN4pi+Ttk1nwF88=";
-  vendorSha256 = "sha256-OJa8pQgf5PlECZZkFV9fyCOdh6CrregY1BWycx7JPFE=";
-  version = "0.6.12";
-in buildGoModule {
-  inherit version;
-  inherit vendorSha256;
-
-  pname = "terraform-provider-libvirt";
-
-  src = fetchFromGitHub {
-    inherit sha256;
-
-    owner = "dmacvicar";
-    repo = "terraform-provider-libvirt";
-    rev = "v${version}";
-  };
-
-  nativeBuildInputs = [ pkg-config makeWrapper ];
-
-  buildInputs = [ libvirt ];
-
-  # mkisofs needed to create ISOs holding cloud-init data,
-  # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
-  propagatedBuildInputs = [ cdrtools ];
-
-  # Terraform allow checking the provider versions, but this breaks
-  # if the versions are not provided via file paths.
-  postBuild = "mv $GOPATH/bin/terraform-provider-libvirt{,_v${version}}";
-
-  ldflags = [ "-X main.version=${version}" ];
-  passthru.provider-source-address = "registry.terraform.io/dmacvicar/libvirt";
-
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://github.com/dmacvicar/terraform-provider-libvirt";
-    description = "Terraform provider for libvirt";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ mic92 ];
-  };
-}
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -579,6 +579,15 @@
    "vendorSha256": "05gx87dwh49zc5mlqnzcqn46pjf9q4wsv9l15pjr3spczzi11cnz",
    "version": "2.2.0"
  },
+  "libvirt": {
+    "owner": "dmacvicar",
+    "provider-source-address": "registry.terraform.io/dmacvicar/libvirt",
+    "repo": "terraform-provider-libvirt",
+    "rev": "v0.6.12",
+    "sha256": "1kqpy1cr7vg4iclxwd7wa4fmhw63l3z5gn07knfx9in7nm380pyn",
+    "vendorSha256": "0l9wr4g77chmshcfibdbl23rs8y8bxgiar4n152gkr0z12jvr5iq",
+    "version": "0.6.12"
+  },
  "linode": {
    "owner": "linode",
    "provider-source-address": "registry.terraform.io/linode/linode",
--- a/pkgs/applications/office/timedoctor/default.nix
+++ b/pkgs/applications/office/timedoctor/default.nix
@ -117,7 +117,7 @@ appimageTools.wrapType2 {
    description = "Employee time tracking software";
    homepage = "https://www.timedoctor.com";
    license = licenses.unfree;
-    maintainers = with maintainers; [ kamadorueda ];
+    maintainers = with maintainers; [ dsalaza4 ];
    platforms = [ "x86_64-linux" ];
    # gpgme for i686-linux failed to build.
    broken = true;
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.36.0";
+  version = "3.37.0";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
    # from. this is then used to check whether an olean file should be
    # rebuilt. don't use a tag as rev because this will get replaced into
    # src/githash.h.in in preConfigure.
-    rev    = "e948149d3d1bbdb8eac9cd103d58626a59fae3b9";
-    sha256 = "1lcjif29lfj3myc6j63ifk8fdvylyv8g82g2dv0d85nz7mpbq47b";
+    rev    = "e69ab934262eb6f141344fdaec98ede68a9102b6";
+    sha256 = "19sigzbrdl90jqk7lvl3q8j6n4nnidzwp9zzmzgq3zxxgywa2ghp";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@ -5,11 +5,11 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation rec {
  pname = "gmsh";
-  version = "4.9.0";
+  version = "4.9.2";

  src = fetchurl {
-    url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "sha256-uO8TPJtm/+Et8XR+ctSs8Z8esenNlesPV3y8QIHZvqM=";
+    url = "https://gmsh.info/src/gmsh-${version}-source.tgz";
+    sha256 = "sha256-26KB4DNYT12gfi2Y1656PcSBcjyybCxye2X8ILMBYYw=";
  };

  buildInputs = [ blas lapack gmm fltk libjpeg zlib libGLU libGL
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "A three-dimensional finite element mesh generator";
-    homepage = "http://gmsh.info/";
+    homepage = "https://gmsh.info/";
    platforms = [ "x86_64-linux" ];
    license = lib.licenses.gpl2Plus;
  };
--- a/pkgs/applications/window-managers/dwm/default.nix
+++ b/pkgs/applications/window-managers/dwm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "dwm";
-  version = "6.2";
+  version = "6.3";

  src = fetchurl {
    url = "https://dl.suckless.org/dwm/${pname}-${version}.tar.gz";
-    sha256 = "03hirnj8saxnsfqiszwl2ds7p0avg20izv9vdqyambks00p2x44p";
+    sha256 = "utqgKFKbH7of1/moTztk8xGQRmyFgBG1Pi97cMajB40=";
  };

  buildInputs = [ libX11 libXinerama libXft ];
--- a/pkgs/build-support/mkshell/default.nix
+++ b/pkgs/build-support/mkshell/default.nix
@ -1,9 +1,9 @@
-{ lib, stdenv }:
+{ lib, stdenv, buildEnv }:

 # A special kind of derivation that is only meant to be consumed by the
 # nix-shell.
-{
-  # a list of packages to add to the shell environment
+{ name ? "nix-shell"
+, # a list of packages to add to the shell environment
  packages ? [ ]
 , # propagate all the inputs from the given derivations
  inputsFrom ? [ ]
@ -15,10 +15,11 @@
 }@attrs:
 let
  mergeInputs = name:
-    (attrs.${name} or []) ++
+    (attrs.${name} or [ ]) ++
    (lib.subtractLists inputsFrom (lib.flatten (lib.catAttrs name inputsFrom)));

  rest = builtins.removeAttrs attrs [
+    "name"
    "packages"
    "inputsFrom"
    "buildInputs"
@ -30,8 +31,7 @@ let
 in

 stdenv.mkDerivation ({
-  name = "nix-shell";
-  phases = [ "nobuildPhase" ];
+  inherit name;

  buildInputs = mergeInputs "buildInputs";
  nativeBuildInputs = packages ++ (mergeInputs "nativeBuildInputs");
@ -41,10 +41,15 @@ stdenv.mkDerivation ({
  shellHook = lib.concatStringsSep "\n" (lib.catAttrs "shellHook"
    (lib.reverseList inputsFrom ++ [ attrs ]));

-  nobuildPhase = ''
-    echo
-    echo "This derivation is not meant to be built, aborting";
-    echo
-    exit 1
+  phases = [ "buildPhase" ];
+
+  buildPhase = ''
+    echo "------------------------------------------------------------" >>$out
+    echo " WARNING: the existence of this path is not guaranteed." >>$out
+    echo " It is an internal implementation detail for pkgs.mkShell."   >>$out
+    echo "------------------------------------------------------------" >>$out
+    echo >> $out
+    # Record all build inputs as runtime dependencies
+    export >> $out
  '';
 } // rest)
--- a/pkgs/data/themes/graphite/default.nix
+++ b/pkgs/data/themes/graphite/default.nix
@ -0,0 +1,87 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gnome-themes-extra
+, gtk-engine-murrine
+, jdupes
+, sassc
+, themeVariants ? [] # default: blue
+, colorVariants ? [] # default: all
+, sizeVariants ? [] # default: standard
+, tweaks ? []
+, wallpapers ? false
+}:
+
+let
+  pname = "graphite-gtk-theme";
+
+  throwIfNotSubList = name: given: valid:
+    let
+      unexpected = lib.subtractLists valid given;
+    in
+      lib.throwIfNot (unexpected == [])
+        "${name}: ${builtins.concatStringsSep ", " (builtins.map builtins.toString unexpected)} unexpected; valid ones: ${builtins.concatStringsSep ", " (builtins.map builtins.toString valid)}";
+
+in
+throwIfNotSubList "${pname}: theme variants" themeVariants [ "default" "purple" "pink" "red" "orange" "yellow" "green" "teal" "blue" "all" ]
+throwIfNotSubList "${pname}: color variants" colorVariants [ "standard" "light" "dark" ]
+throwIfNotSubList "${pname}: size variants" sizeVariants [ "standard" "compact" ]
+throwIfNotSubList "${pname}: tweaks" tweaks [ "nord" "black" "midblack" "rimless" "normal" ]
+
+stdenvNoCC.mkDerivation {
+  inherit pname;
+  version = "unstable-2022-01-04";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = "947cac4966377d8f5b5a4e2966ec2b9a6041d205";
+    sha256 = "11pl8hzk4fwniqdib0ffvjilpspr1n5pg1gw39kal13wxh4sdg28";
+  };
+
+  nativeBuildInputs = [
+    jdupes
+    sassc
+  ];
+
+  buildInputs = [
+    gnome-themes-extra
+  ];
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    patchShebangs install.sh
+
+    name= ./install.sh \
+      ${lib.optionalString (themeVariants != []) "--theme " + builtins.toString themeVariants} \
+      ${lib.optionalString (colorVariants != []) "--color " + builtins.toString colorVariants} \
+      ${lib.optionalString (sizeVariants != []) "--size " + builtins.toString sizeVariants} \
+      ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks} \
+      --dest $out/share/themes
+
+    ${lib.optionalString wallpapers ''
+      mkdir -p $out/share/backgrounds
+      cp -a wallpaper/Graphite-normal/*.png $out/share/backgrounds/
+      ${lib.optionalString (builtins.elem "nord" tweaks) ''
+        cp -a wallpaper/Graphite-nord/*.png $out/share/backgrounds/
+      ''}
+    ''}
+
+    jdupes -L -r $out/share
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Flat Gtk+ theme based on Elegant Design";
+    homepage = "https://github.com/vinceliuice/Graphite-gtk-theme";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.romildo ];
+  };
+}
--- a/pkgs/development/compilers/go/1.17.nix
+++ b/pkgs/development/compilers/go/1.17.nix
@ -54,11 +54,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.17.5";
+  version = "1.17.6";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-Pe+5oJvtBCQDGV6HLcvIxvrhSFljMyJ5Zo7FLoCpWi0=";
+    sha256 = "sha256-TcG78/9h8MH/Kxk1Xm2IFRpwEmJopHx2FHdobvlHSMg=";
  };

  # perl is used for testing go vet
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, curl, openssl, s2n-tls, zlib
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, curl, openssl, s2n-tls, zlib
 , aws-crt-cpp
 , aws-c-cal, aws-c-common, aws-c-event-stream, aws-c-io, aws-checksums
 , CoreAudio, AudioToolbox
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  version = "1.9.150";

  src = fetchFromGitHub {
-    owner = "awslabs";
+    owner = "aws";
    repo = "aws-sdk-cpp";
    rev = version;
    sha256 = "sha256-fgLdXWQKHaCwulrw9KV3vpQ71DjnQAL4heIRW7Rk7UY=";
@ -82,6 +82,12 @@ stdenv.mkDerivation rec {

  patches = [
    ./cmake-dirs.patch
+
+    # fix cmake config
+    (fetchpatch {
+      url = "https://github.com/aws/aws-sdk-cpp/commit/b102aaf5693c4165c84b616ab9ffb9edfb705239.diff";
+      sha256 = "sha256-38QBo3MEFpyHPb8jZEURRPkoeu4DqWhVeErJayiHKF0=";
+    })
  ];

  # Builds in 2+h with 2 cores, and ~10m with a big-parallel builder.
@ -89,7 +95,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "A C++ interface for Amazon Web Services";
-    homepage = "https://github.com/awslabs/aws-sdk-cpp";
+    homepage = "https://github.com/aws/aws-sdk-cpp";
    license = licenses.asl20;
    platforms = platforms.unix;
    maintainers = with maintainers; [ eelco orivej ];
--- a/pkgs/development/libraries/lensfun/default.nix
+++ b/pkgs/development/libraries/lensfun/default.nix
@ -25,9 +25,9 @@ stdenv.mkDerivation {
  };

  # replace database with a more recent snapshot
-  postUnpack = ''
-    rm -R source/data/db
-    cp -R ${lensfunDatabase}/data/db source/data
+  prePatch = ''
+    rm -R ./data/db
+    cp -R ${lensfunDatabase}/data/db ./data
  '';

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@ -4,9 +4,11 @@
 , meson
 , ninja
 , pkg-config
+, makeFontsConf
 , boost
 , gnutls
 , openssl
+, libdrm
 , libevent
 , lttng-ust
 , gst_all_1
@ -15,16 +17,17 @@
 , doxygen
 , python3
 , python3Packages
+, systemd # for libudev
 }:

 stdenv.mkDerivation {
  pname = "libcamera";
-  version = "unstable-2021-09-24";
+  version = "unstable-2022-01-03";

  src = fetchgit {
    url = "https://git.libcamera.org/libcamera/libcamera.git";
-    rev = "40f5fddca7f774944a53f58eeaebc4db79c373d8";
-    sha256 = "0jklgdv5ma4nszxibms5lkf5d2ips7ncynwa1flglrhl5bl4wkzz";
+    rev = "1db1e31e664c1f613dc964d8519fe75d67b154b6";
+    hash = "sha256-pXYPIU9xDWA870Gp1Jgizi5xnUHRvTqEq/ofFXdVZdg=";
  };

  postPatch = ''
@ -44,6 +47,10 @@ stdenv.mkDerivation {

    # cam integration
    libevent
+    libdrm
+
+    # hotplugging
+    systemd

    # lttng tracing
    lttng-ust
@ -65,11 +72,18 @@ stdenv.mkDerivation {
    openssl
  ];

-  mesonFlags = [ "-Dv4l2=true" "-Dqcam=disabled" ];
+  mesonFlags = [
+    "-Dv4l2=true"
+    "-Dqcam=disabled"
+    "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
+    ];

  # Fixes error on a deprecated declaration
  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";

+  # Silence fontconfig warnings about missing config
+  FONTCONFIG_FILE = makeFontsConf { fontDirectories = []; };
+
  meta = with lib; {
    description = "An open source camera stack and framework for Linux, Android, and ChromeOS";
    homepage = "https://libcamera.org";
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@ -1,15 +1,13 @@
-{ lib, stdenv, fetchurl, pkg-config
-
-, abiVersion ? "6"
-, mouseSupport ? false
-, unicode ? true
-, enableStatic ? stdenv.hostPlatform.isStatic
-, enableShared ? !enableStatic
-, withCxx ? !stdenv.hostPlatform.useAndroidPrebuilt
-
-, gpm
-
+{ lib
+, stdenv
+, fetchurl
 , buildPackages
+, pkg-config
+, abiVersion ? "6"
+, enableStatic ? stdenv.hostPlatform.isStatic
+, withCxx ? !stdenv.hostPlatform.useAndroidPrebuilt
+, mouseSupport ? false, gpm
+, unicodeSupport ? true
 }:

 stdenv.mkDerivation rec {
@ -31,13 +29,13 @@ stdenv.mkDerivation rec {
  setOutputFlags = false; # some aren't supported

  configureFlags = [
-    (lib.withFeature enableShared "shared")
+    (lib.withFeature (!enableStatic) "shared")
    "--without-debug"
    "--enable-pc-files"
    "--enable-symlinks"
    "--with-manpage-format=normal"
    "--disable-stripping"
-  ] ++ lib.optional unicode "--enable-widec"
+  ] ++ lib.optional unicodeSupport "--enable-widec"
    ++ lib.optional (!withCxx) "--without-cxx"
    ++ lib.optional (abiVersion == "5") "--with-abi-version=5"
    ++ lib.optional stdenv.hostPlatform.isNetBSD "--enable-rpath"
@ -49,12 +47,16 @@ stdenv.mkDerivation rec {
  # Only the C compiler, and explicitly not C++ compiler needs this flag on solaris:
  CFLAGS = lib.optionalString stdenv.isSunOS "-D_XOPEN_SOURCE_EXTENDED";

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
  nativeBuildInputs = [
    pkg-config
  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    buildPackages.ncurses
  ];
+
  buildInputs = lib.optional (mouseSupport && stdenv.isLinux) gpm;

  preConfigure = ''
@ -147,31 +149,26 @@ stdenv.mkDerivation rec {
    rm "$out"/lib/*.a
  '';

-  meta = {
-    description = "Free software emulation of curses in SVR4 and more";
-
-    longDescription = ''
-      The Ncurses (new curses) library is a free software emulation of
-      curses in System V Release 4.0, and more.  It uses Terminfo
-      format, supports pads and color and multiple highlights and
-      forms characters and function-key mapping, and has all the other
-      SYSV-curses enhancements over BSD Curses.
-
-      The ncurses code was developed under GNU/Linux.  It has been in
-      use for some time with OpenBSD as the system curses library, and
-      on FreeBSD and NetBSD as an external package.  It should port
-      easily to any ANSI/POSIX-conforming UNIX.  It has even been
-      ported to OS/2 Warp!
-    '';
-
+  meta = with lib; {
    homepage = "https://www.gnu.org/software/ncurses/";
+    description = "Free software emulation of curses in SVR4 and more";
+    longDescription = ''
+      The Ncurses (new curses) library is a free software emulation of curses in
+      System V Release 4.0, and more. It uses Terminfo format, supports pads and
+      color and multiple highlights and forms characters and function-key
+      mapping, and has all the other SYSV-curses enhancements over BSD Curses.

-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
+      The ncurses code was developed under GNU/Linux. It has been in use for
+      some time with OpenBSD as the system curses library, and on FreeBSD and
+      NetBSD as an external package. It should port easily to any
+      ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
+    '';
+    license = licenses.mit;
+    platforms = platforms.all;
  };

  passthru = {
    ldflags = "-lncurses";
-    inherit unicode abiVersion;
+    inherit unicodeSupport abiVersion;
  };
 }
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@ -275,7 +275,12 @@ stdenv.mkDerivation {
  propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy
    ++ lib.optionals enableCuda [ cudatoolkit nvidia-optical-flow-sdk ];

-  nativeBuildInputs = [ cmake pkg-config unzip ];
+  nativeBuildInputs = [ cmake pkg-config unzip ]
+  ++ lib.optionals enablePython [
+    pythonPackages.pip
+    pythonPackages.wheel
+    pythonPackages.setuptools
+  ];

  NIX_CFLAGS_COMPILE = lib.optionalString enableEXR "-I${ilmbase.dev}/include/OpenEXR";

@ -333,6 +338,21 @@ stdenv.mkDerivation {
  postInstall = ''
    sed -i "s|{exec_prefix}/$out|{exec_prefix}|;s|{prefix}/$out|{prefix}|" \
      "$out/lib/pkgconfig/opencv4.pc"
+  ''
+  # install python distribution information, so other packages can `import opencv`
+  + lib.optionalString enablePython ''
+    pushd $NIX_BUILD_TOP/$sourceRoot/modules/python/package
+    python -m pip wheel --verbose --no-index --no-deps --no-clean --no-build-isolation --wheel-dir dist .
+
+    pushd dist
+    python -m pip install ./*.whl --no-index --no-warn-script-location --prefix="$out" --no-cache
+
+    # the cv2/__init__.py just tries to check provide "nice user feedback" if the installation is bad
+    # however, this also causes infinite recursion when used by other packages
+    rm -r $out/${pythonPackages.python.sitePackages}/cv2
+
+    popd
+    popd
  '';

  passthru = lib.optionalAttrs enablePython { pythonPath = [ ]; };
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -60,16 +60,12 @@
 }:

 let
-  fontsConf = makeFontsConf {
-    fontDirectories = [ ];
-  };
-
-  mesonEnable = b: if b then "enabled" else "disabled";
+  mesonEnableFeature = b: if b then "enabled" else "disabled";
  mesonList = l: "[" + lib.concatStringsSep "," l + "]";

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.42";
+    version = "0.3.43";

    outputs = [
      "out"
@ -87,7 +83,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-Iyd5snOt+iCT7W0+FlfvhMUZo/gF+zr9JX4HIGVdHto=";
+      sha256 = "sha256-vjMA9dQvZe7dPbF9BNtCYf1V240RUBdtxeyqFjWA4j4=";
    };

    patches = [
@ -103,15 +99,6 @@ let
      ./0090-pipewire-config-template-paths.patch
      # Place SPA data files in lib output to avoid dependency cycles
      ./0095-spa-data-dir.patch
-      # Fix attempt to put system service units into pkgs.systemd.
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/b666edde787b167c6e19b9356257d48007357acc.diff";
-        sha256 = "1pmnyyvrjykr46ld4a5frq3cc739f8h4jwvfj414lyx8c6ybm63s";
-      })
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/5054b48c9de655b4b48f7c801cb305d9eb122520.diff";
-        sha256 = "0myhb7h4g7x2nr08dpx8d7nqhsmzp90yanmkvm627r1xxnnr3ivn";
-      })
    ];

    nativeBuildInputs = [
@ -159,33 +146,32 @@ let
      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
      "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
      "-Dlibjack-path=${placeholder "jack"}/lib"
-      "-Dlibcamera=${mesonEnable libcameraSupport}"
-      "-Droc=${mesonEnable rocSupport}"
-      "-Dlibpulse=${mesonEnable pulseTunnelSupport}"
-      "-Davahi=${mesonEnable zeroconfSupport}"
-      "-Dgstreamer=${mesonEnable gstreamerSupport}"
+      "-Dlibcamera=${mesonEnableFeature libcameraSupport}"
+      "-Droc=${mesonEnableFeature rocSupport}"
+      "-Dlibpulse=${mesonEnableFeature pulseTunnelSupport}"
+      "-Davahi=${mesonEnableFeature zeroconfSupport}"
+      "-Dgstreamer=${mesonEnableFeature gstreamerSupport}"
      "-Dsystemd-system-service=enabled"
-      "-Dffmpeg=${mesonEnable ffmpegSupport}"
-      "-Dbluez5=${mesonEnable bluezSupport}"
-      "-Dbluez5-backend-hsp-native=${mesonEnable nativeHspSupport}"
-      "-Dbluez5-backend-hfp-native=${mesonEnable nativeHfpSupport}"
-      "-Dbluez5-backend-ofono=${mesonEnable ofonoSupport}"
-      "-Dbluez5-backend-hsphfpd=${mesonEnable hsphfpdSupport}"
+      "-Dffmpeg=${mesonEnableFeature ffmpegSupport}"
+      "-Dbluez5=${mesonEnableFeature bluezSupport}"
+      "-Dbluez5-backend-hsp-native=${mesonEnableFeature nativeHspSupport}"
+      "-Dbluez5-backend-hfp-native=${mesonEnableFeature nativeHfpSupport}"
+      "-Dbluez5-backend-ofono=${mesonEnableFeature ofonoSupport}"
+      "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
      "-Dsysconfdir=/etc"
      "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
      "-Dsession-managers="
      "-Dvulkan=enabled"
    ];

-    FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file
+    # Fontconfig error: Cannot load default config file
+    FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };

    doCheck = true;

    postUnpack = ''
-      patchShebangs source/doc/strip-static.sh
      patchShebangs source/doc/input-filter.sh
      patchShebangs source/doc/input-filter-h.sh
-      patchShebangs source/spa/tests/gen-cpp-test.py
    '';

    postInstall = ''
--- a/pkgs/development/libraries/pipewire/wireplumber.nix
+++ b/pkgs/development/libraries/pipewire/wireplumber.nix
@ -0,0 +1,82 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, nix-update-script
+, # base build deps
+  meson
+, pkg-config
+, ninja
+, # docs build deps
+  python3
+, doxygen
+, graphviz
+, # GI build deps
+  gobject-introspection
+, # runtime deps
+  glib
+, systemd
+, lua5_4
+, pipewire
+, # options
+  enableDocs ? true
+, enableGI ? stdenv.hostPlatform == stdenv.buildPlatform
+}:
+let
+  mesonEnableFeature = b: if b then "enabled" else "disabled";
+in
+stdenv.mkDerivation rec {
+  pname = "wireplumber";
+  version = "0.4.6";
+
+  outputs = [ "out" "dev" ] ++ lib.optional enableDocs "doc";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "pipewire";
+    repo = "wireplumber";
+    rev = version;
+    sha256 = "sha256-y+Gj9EZn67W3U81zXgp+6JAFxZSZTwwT0TB3Kueb/Tw=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+  ] ++ lib.optionals enableDocs [
+    graphviz
+  ] ++ lib.optionals enableGI [
+    gobject-introspection
+  ] ++ lib.optionals (enableDocs || enableGI) [
+    doxygen
+    (python3.withPackages (ps: with ps;
+    lib.optionals enableDocs [ sphinx sphinx_rtd_theme breathe ] ++
+      lib.optionals enableGI [ lxml ]
+    ))
+  ];
+
+  buildInputs = [
+    glib
+    systemd
+    lua5_4
+    pipewire
+  ];
+
+  mesonFlags = [
+    "-Dsystem-lua=true"
+    "-Delogind=disabled"
+    "-Ddoc=${mesonEnableFeature enableDocs}"
+    "-Dintrospection=${mesonEnableFeature enableGI}"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "A modular session / policy manager for PipeWire";
+    homepage = "https://pipewire.org";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ k900 ];
+  };
+}
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@ -2,7 +2,7 @@

 buildPythonPackage rec {
  pname = "awscrt";
-  version = "0.12.6";
+  version = "0.13.0";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreFoundation Security ];

@ -22,7 +22,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "65d71b4cd78165bea962dfbda361b47b9b5a6198d8074046b8667da9653d0752";
+    sha256 = "f8c46335bdf94a5e48d3df2018edbd07c4c903635501c62c1bea4153f407531a";
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/diskcache/default.nix
+++ b/pkgs/development/python-modules/diskcache/default.nix
@ -1,50 +1,62 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
-, pytest-cov
-, pytest-xdist
 , pytest-django
-, mock
+, pytest-xdist
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "diskcache";
-  version = "5.2.1";
+  version = "5.4.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "grantjenks";
    repo = "python-diskcache";
    rev = "v${version}";
-    sha256 = "sha256-dWtEyyWpg0rxEwyhBdPyApzgS9o60HVGbtY76ELHvX8=";
+    hash = "sha256-c/k8mx/T4RkseDobJ2gtcuom0A6Ewyw4aP2Bk9pxV+o=";
  };

  checkInputs = [
-    pytestCheckHook
-    pytest-cov
-    pytest-xdist
    pytest-django
-    mock
+    pytest-xdist
+    pytestCheckHook
  ];

-  # Darwin sandbox causes most tests to fail.
+  postPatch = ''
+    sed -i "/--cov/d" tox.ini
+  '';
+
+  # Darwin sandbox causes most tests to fail
  doCheck = !stdenv.isDarwin;
-  pythonImportsCheck = [ "diskcache" ];

  disabledTests = [
-    # very time sensitive, can fail on over subscribed machines
+    # Very time sensitive, can fail on over subscribed machines
    "test_incr_update_keyerror"
+    # AssertionError: 'default' is not None
+    "test_decr_version"
+    "test_incr_version"
+    "test_get_or_set"
+    "test_get_many"
  ];

  pytestFlagsArray = [
    "-n $NIX_BUILD_CORES"
  ];

+  pythonImportsCheck = [
+    "diskcache"
+  ];
+
  meta = with lib; {
    description = "Disk and file backed persistent cache";
    homepage = "http://www.grantjenks.com/docs/diskcache/";
    license = licenses.asl20;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@ -3,14 +3,14 @@

 buildPythonPackage rec {
  pname = "django-allauth";
-  version = "0.40.0";
+  version = "0.47.0";

  # no tests on PyPI
  src = fetchFromGitHub {
    owner = "pennersr";
    repo = pname;
    rev = version;
-    sha256 = "10id4k01p1hg5agb8cmllg8mv4kc7ryl75br10idwxabqqp4vla1";
+    sha256 = "sha256-wKrsute6TCl331UrxNEBf/zTtGnyGHsOZQwdiicbg2o=";
  };

  propagatedBuildInputs = [ requests requests_oauthlib django python3-openid ];
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@ -1,22 +1,58 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, django, requests, oauthlib
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# propagates
+, django
+, jwcrypto
+, requests
+, oauthlib
+
+# tests
+, djangorestframework
+, pytest-django
+, pytest-xdist
+, pytest-mock
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "django-oauth-toolkit";
-  version = "1.2.0";
+  version = "1.6.1";
+  format = "setuptools";

  src = fetchFromGitHub {
    owner = "jazzband";
    repo = pname;
    rev = version;
-    sha256 = "1zbksxrcxlqnapmlvx4rgvpqc4plgnq0xnf45cjwzwi1626zs8g6";
+    sha256 = "sha256-TOrFxQULwiuwpVFqRwRkfTW+GRudLNy6F/gIjUYjZhI=";
  };

-  propagatedBuildInputs = [ django requests oauthlib ];
+  postPatch = ''
+    sed -i '/cov/d' tox.ini
+  '';

-  # django.core.exceptions.ImproperlyConfigured: Requested setting OAUTH2_PROVIDER, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings
-  doCheck = false;
+  propagatedBuildInputs = [
+    django
+    jwcrypto
+    oauthlib
+    requests
+  ];
+
+  DJANGO_SETTINGS_MODULE = "tests.settings";
+
+  checkInputs = [
+    djangorestframework
+    pytest-django
+    pytest-xdist
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Failed to get a valid response from authentication server. Status code: 404, Reason: Not Found.
+    "test_response_when_auth_server_response_return_404"
+  ];

  meta = with lib; {
    description = "OAuth2 goodies for the Djangonauts";
--- a/pkgs/development/python-modules/django_guardian/default.nix
+++ b/pkgs/development/python-modules/django_guardian/default.nix
@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchPypi
-, django_environ, mock, django
+, django-environ, mock, django
 , pytest, pytest-runner, pytest-django
 }:
 buildPythonPackage rec {
@ -11,7 +11,7 @@ buildPythonPackage rec {
    sha256 = "c58a68ae76922d33e6bdc0e69af1892097838de56e93e78a8361090bcd9f89a0";
  };

-  checkInputs = [ pytest pytest-runner pytest-django django_environ mock ];
+  checkInputs = [ pytest pytest-runner pytest-django django-environ mock ];
  propagatedBuildInputs = [ django ];

  meta = with lib; {
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "fastapi";
-  version = "0.70.1";
+  version = "0.71.0";
  format = "flit";

  disabled = pythonOlder "3.6";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "tiangolo";
    repo = pname;
    rev = version;
-    sha256 = "sha256-iwjxcAe8h38PPTTDGCxIJSB7zCS0FA0gOcKUjPpk3yg=";
+    sha256 = "sha256-J4j7lQm22pbwfMkQGF1s2xyFU4MCwXrAqDmRJmLmKGg=";
  };

  propagatedBuildInputs = [
@ -64,6 +64,8 @@ buildPythonPackage rec {
  disabledTestPaths = [
    # Disabled tests require orjson which requires rust nightly
    "tests/test_default_response_class.py"
+    # Don't test docs and examples
+    "docs_src"
  ];

  disabledTests = [
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "flux-led";
-  version = "0.27.40";
+  version = "0.27.43";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "flux_led";
    rev = version;
-    sha256 = "sha256-imfdLomMjeGAyVBSygx+TV0DA9OrMreeSlzzrJ2B9cc=";
+    sha256 = "sha256-g1K5NoZm9nd1M17who0LtRa5n1P7P/XRs6Qz63vmTxw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/gql/default.nix
+++ b/pkgs/development/python-modules/gql/default.nix
@ -0,0 +1,77 @@
+{ lib
+, aiofiles
+, aiohttp
+, botocore
+, buildPythonPackage
+, fetchFromGitHub
+, graphql-core
+, mock
+, parse
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-toolbelt
+, urllib3
+, vcrpy
+, websockets
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "gql";
+  version = "3.0.0rc0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "graphql-python";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-yr1DyMj/0C9XPTyGdbQbn7nMRKr4JwItFDsqvl/goqU=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    botocore
+    graphql-core
+    requests
+    requests-toolbelt
+    urllib3
+    websockets
+    yarl
+  ];
+
+  checkInputs = [
+    aiofiles
+    mock
+    parse
+    pytest-asyncio
+    pytestCheckHook
+    vcrpy
+  ];
+
+  disabledTests = [
+    # Tests requires network access
+    "test_execute_result_error"
+    "test_http_transport"
+  ];
+
+  disabledTestPaths = [
+    # Exclude linter tests
+    "gql-checker/tests/test_flake8_linter.py"
+    "gql-checker/tests/test_pylama_linter.py"
+  ];
+
+  pythonImportsCheck = [
+    "gql"
+  ];
+
+  meta = with lib; {
+    description = "GraphQL client in Python";
+    homepage = "https://github.com/graphql-python/gql";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/gradient-utils/default.nix
+++ b/pkgs/development/python-modules/gradient-utils/default.nix
@ -7,6 +7,7 @@
 , poetry-core
 , prometheus-client
 , pytestCheckHook
+, pythonOlder
 , requests
 }:

@ -15,6 +16,8 @@ buildPythonPackage rec {
  version = "0.5.0";
  format = "pyproject";

+  disabled = pythonOlder "3.6";
+
  src = fetchFromGitHub {
    owner = "Paperspace";
    repo = pname;
@ -22,15 +25,9 @@ buildPythonPackage rec {
    sha256 = "19plkgwwfs6298vjplgsvhirixi3jbngq5y07x9c0fjxk39fa2dk";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'numpy = "1.18.5"' 'numpy = "^1.18.5"' \
-      --replace 'hyperopt = "0.1.2"' 'hyperopt = ">=0.1.2"' \
-      --replace 'wheel = "^0.35.1"' 'wheel = "*"' \
-      --replace 'prometheus-client = ">=0.8,<0.10"' 'prometheus-client = "*"'
-  '';
-
-  nativeBuildInputs = [ poetry-core ];
+  nativeBuildInputs = [
+    poetry-core
+  ];

  propagatedBuildInputs = [
    hyperopt
@ -44,20 +41,24 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'wheel = "^0.35.1"' 'wheel = "*"' \
+      --replace 'prometheus-client = ">=0.8,<0.10"' 'prometheus-client = "*"'
+  '';
+
  preCheck = ''
    export HOSTNAME=myhost-experimentId
  '';

-  disabledTests = [
-    "test_add_metrics_pushes_metrics" # requires a working prometheus push gateway
-  ];
-
  disabledTestPaths = [
-    # needs network access
+    # Requires a working Prometheus push gateway
    "tests/integration/test_metrics.py"
  ];

-  pythonImportsCheck = [ "gradient_utils" ];
+  pythonImportsCheck = [
+    "gradient_utils"
+  ];

  meta = with lib; {
    description = "Python utils and helpers library for Gradient";
--- a/pkgs/development/python-modules/gradient/default.nix
+++ b/pkgs/development/python-modules/gradient/default.nix
@ -9,6 +9,7 @@
 , fetchPypi
 , gradient_statsd
 , gradient-utils
+, gql
 , halo
 , marshmallow
 , progressbar2
@ -22,17 +23,19 @@

 buildPythonPackage rec {
  pname = "gradient";
-  version = "1.9.0";
+  version = "1.9.1";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "47be02511d7ea66a13559598851cb435d435fb3f7676f6de17292d06daad8947";
+    hash = "sha256-zimOh4bc9EQGpqMky/etwnAF04onJ2m/KAl29IaAeAY=";
  };

  postPatch = ''
    substituteInPlace setup.py \
      --replace 'attrs<=' 'attrs>=' \
      --replace 'colorama==' 'colorama>=' \
+      --replace 'gql[requests]==3.0.0a6' 'gql' \
      --replace 'PyYAML==' 'PyYAML>=' \
      --replace 'marshmallow<' 'marshmallow>=' \
      --replace 'websocket-client==' 'websocket-client>='
@ -45,6 +48,7 @@ buildPythonPackage rec {
    click-didyoumean
    click-help-colors
    colorama
+    gql
    gradient_statsd
    gradient-utils
    halo
@ -58,17 +62,20 @@ buildPythonPackage rec {
    websocket-client
  ];

-  # tries to use /homeless-shelter to mimic container usage, etc
+  # Tries to use /homeless-shelter to mimic container usage, etc
  doCheck = false;

+  # marshmallow.exceptions.StringNotCollectionError: "only" should be a collection of strings.
+  # Support for marshmallow > 3
+  # pythonImportsCheck = [
+  #   "gradient"
+  # ];
+
  meta = with lib; {
    description = "The command line interface for Gradient";
    homepage = "https://github.com/Paperspace/gradient-cli";
    license = licenses.isc;
    platforms = platforms.unix;
    maintainers = with maintainers; [ thoughtpolice ];
-    # There is no support for click > 8
-    # https://github.com/Paperspace/gradient-cli/issues/368
-    broken = true;
  };
 }
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "0.14.0";
+  version = "0.15.0";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Olwol/DhsVJznxpiMB57zkPuco0RBxMy8cfzSQMZZrU=";
+    sha256 = "sha256-jTUMnBtV0wVFWe+4MWOAvFDLvminM0gVTm0hkBOvnH8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@ -10,29 +10,41 @@

 buildPythonPackage rec {
  pname = "jupyterlab";
-  version = "3.2.5";
-  disabled = pythonOlder "3.5";
+  version = "3.2.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "31b28f473b0f5826d2020583973c385526f0559b5b26efac6b8035ac1562874a";
+    sha256 = "04e763974010f0f424ee889238fa488ee11708d0546e6df6e2cad9e0fc724bdb";
  };

-  nativeBuildInputs = [ jupyter-packaging ];
+  nativeBuildInputs = [
+    jupyter-packaging
+  ];

-  propagatedBuildInputs = [ jupyterlab_server notebook nbclassic ];
+  propagatedBuildInputs = [
+    jupyterlab_server
+    notebook
+    nbclassic
+  ];

  makeWrapperArgs = [
-    "--set" "JUPYTERLAB_DIR" "$out/share/jupyter/lab"
+    "--set"
+    "JUPYTERLAB_DIR"
+    "$out/share/jupyter/lab"
  ];

  # Depends on npm
  doCheck = false;

-  pythonImportsCheck = [ "jupyterlab" ];
+  pythonImportsCheck = [
+    "jupyterlab"
+  ];

  meta = with lib; {
-    description = "Jupyter lab environment notebook server extension.";
+    description = "Jupyter lab environment notebook server extension";
    license = with licenses; [ bsd3 ];
    homepage = "https://jupyter.org/";
    maintainers = with maintainers; [ zimbatm costrouc ];
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage rec {
  pname = "makefun";
-  version = "1.13.0";
+  version = "1.13.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "2c673d2b4f0ef809347513cb45e3b23a04228588af7c9ac859e99247abac516a";
+    sha256 = "985bb8b670ffbbb95d2a8aa996d318e6e9a3f26fc6f3ef2da93ebdf8f9c616bf";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/oauthlib/default.nix
+++ b/pkgs/development/python-modules/oauthlib/default.nix
@ -1,31 +1,40 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, mock
-, pytest
-, cryptography
+
+# propagates
 , blinker
+, cryptography
 , pyjwt
+
+# test
+, mock
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "oauthlib";
-  version = "unstable-2020-05-08";
+  version = "3.1.1";
+  format = "setuptools";

  # master supports pyjwt==1.7.1
  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    rev = "46647402896db5f0d979eba9594623e889739060";
-    sha256 = "1wrdjdvlfcd74lckcgascnasrffg8sip0z673si4ag5kv4afiz3l";
+    rev = "v${version}";
+    hash = "sha256:1bgxpzh11i0x7h9py3a29cz5z714b3p498b62znnn5ciy0cr80sv";
  };

-  checkInputs = [ mock pytest ];
-  propagatedBuildInputs = [ cryptography blinker pyjwt ];
+  propagatedBuildInputs = [
+    blinker
+    cryptography
+    pyjwt
+  ];

-  checkPhase = ''
-    py.test tests/
-  '';
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];

  meta = with lib; {
    homepage = "https://github.com/idan/oauthlib";
--- a/pkgs/development/python-modules/pixelmatch/default.nix
+++ b/pkgs/development/python-modules/pixelmatch/default.nix
@ -1,15 +1,26 @@
-{ lib, buildPythonPackage, fetchgit, poetry-core, pytestCheckHook, pytest-benchmark, pytest-mypy, pillow }:
+{ lib
+, buildPythonPackage
+, fetchgit
+, pillow
+, poetry-core
+, pytest-benchmark
+, pytest-mypy
+, pytestCheckHook
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "pixelmatch";
-  version = "0.2.2";
+  version = "0.2.3";
  format = "pyproject";

-  # test fixtures are stored in LFS
+  disabled = pythonOlder "3.6";
+
+  # Test fixtures are stored in LFS
  src = fetchgit {
    url = "https://github.com/whtsky/pixelmatch-py";
    rev = "v${version}";
-    sha256 = "1dsix507dxqik9wvgzscvf2pifbg7gx74krrsalqbfcmm7d1i7xl";
+    hash = "sha256-/zRQhwz+HjT0Hs4CunsqHxHWEtoIH9qMBowRb0Pps6Y=";
    fetchLFS = true;
  };

@ -18,19 +29,24 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    pytestCheckHook
+    pillow
    pytest-benchmark
    pytest-mypy
-    pillow
+    pytestCheckHook
  ];

  pytestFlagsArray = [
-    "--mypy"
+    # Incompatible types in assignment
+    #"--mypy"
    "--benchmark-disable"
  ];

+  pythonImportsCheck = [
+    "pixelmatch"
+  ];
+
  meta = with lib; {
-    description = "A pixel-level image comparison library.";
+    description = "Pixel-level image comparison library";
    homepage = "https://github.com/whtsky/pixelmatch-py";
    license = licenses.isc;
    maintainers = with maintainers; [ petabyteboy ];
--- a/pkgs/development/python-modules/ppscore/default.nix
+++ b/pkgs/development/python-modules/ppscore/default.nix
@ -1,33 +1,41 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, isPy27
 , pandas
-, scikit-learn
 , pytestCheckHook
+, pythonOlder
+, scikit-learn
 }:

 buildPythonPackage rec {
  pname = "ppscore";
-  version = "1.1.1";
-  disabled = isPy27;
+  version = "unstable-2021-11-25";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "8080labs";
    repo = pname;
-    rev = version;
-    sha256 = "11y6axhj0nlagf7ax6gas1g06krrmddb1jlmf0mmrmyi7z0vldk2";
+    rev = "c9268c16b6305c5c38e2fe2fd84f43d97ec1aaca";
+    hash = "sha256-qiogjUgcLFauAMpVf2CKNC27c9xR9q7nY69n8/go1ms=";
  };

-  checkInputs = [ pytestCheckHook ];
-
  propagatedBuildInputs = [
    pandas
    scikit-learn
  ];

+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "ppscore"
+  ];
+
  meta = with lib; {
-    description = "A Python implementation of the Predictive Power Score (PPS)";
+    description = "Python implementation of the Predictive Power Score (PPS)";
    homepage = "https://github.com/8080labs/ppscore/";
    license = licenses.mit;
    maintainers = with maintainers; [ evax ];
--- a/pkgs/development/python-modules/pydub/default.nix
+++ b/pkgs/development/python-modules/pydub/default.nix
@ -1,8 +1,18 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, scipy, ffmpeg-full }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+
+# tests
+, ffmpeg-full
+, python
+}:

 buildPythonPackage rec {
  pname = "pydub";
  version = "0.25.1";
+  format = "setuptools";
+
  # pypi version doesn't include required data files for tests
  src = fetchFromGitHub {
    owner = "jiaaro";
@ -11,23 +21,24 @@ buildPythonPackage rec {
    sha256 = "0xskllq66wqndjfmvp58k26cv3w480sqsil6ifwp4gghir7hqc8m";
  };

+  pythonImportsCheck = [
+    "pydub"
+    "pydub.audio_segment"
+    "pydub.playback"
+  ];

-  # disable a test that fails on aarch64 due to rounding errors
-  postPatch = lib.optionalString stdenv.isAarch64 ''
-    substituteInPlace test/test.py \
-      --replace "test_overlay_with_gain_change" "notest_overlay_with_gain_change"
-  '';
-
-  checkInputs = [ scipy ffmpeg-full ];
+  checkInputs = [
+    ffmpeg-full
+  ];

  checkPhase = ''
-    python test/test.py
+    ${python.interpreter} test/test.py
  '';

  meta = with lib; {
-    description = "Manipulate audio with a simple and easy high level interface.";
-    homepage    = "http://pydub.com/";
-    license     = licenses.mit;
-    platforms   = platforms.all;
+    description = "Manipulate audio with a simple and easy high level interface";
+    homepage = "http://pydub.com";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
  };
 }
--- a/pkgs/development/python-modules/pykeyatome/default.nix
+++ b/pkgs/development/python-modules/pykeyatome/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "pykeyatome";
-  version = "1.3.0";
+  version = "1.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "jugla";
    repo = "pyKeyAtome";
    rev = "V${version}";
-    sha256 = "1brcfgqj0bana6yii4083kppz822fgk9xf4mg141b0zfvx2gyjw9";
+    sha256 = "1lvwxcr2ay8h5sr4lmjgs7xgszl1q8ciaqdn6cmrlra27jssl5ax";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pylgnetcast/default.nix
+++ b/pkgs/development/python-modules/pylgnetcast/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "pylgnetcast";
-  version = "0.3.5";
+  version = "0.3.7";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "Drafteed";
    repo = "python-lgnetcast";
    rev = "v${version}";
-    sha256 = "11g7ya4ppqxjiv3fkz9mi6h1afw9icy6xyn4jzm63kjvxqhrwnw4";
+    sha256 = "0pmz52k2sfxj5x2wcwdjks2lqh1gb5zfrjgc6xij8jal4l9xd2dz";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "pynetbox";
-  version = "6.4.1";
+  version = "6.5.0";

  src = fetchFromGitHub {
    owner = "netbox-community";
    repo = pname;
    rev = "v${version}";
-    sha256 = "08k2zxfz23gzbk49r3hmh6r3m5rgx1gk7w83qxi1v4gbm4wr0v9m";
+    sha256 = "1fk64bi7aswsmfqsciamml2wydgfg464h6i7479xfim4mwmkkik4";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/pkgs/development/python-modules/pytest-cases/default.nix
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "pytest-cases";
-  version = "3.6.7";
+  version = "3.6.8";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-ZUAXmIww/tdm7nDAj2VDXq0B6raHeDX1ywxnnv3EVIE=";
+    sha256 = "d423e87b30e1080cc162d86c72bfa35861cccfe3539125e81c68ba142ab974bc";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/types-decorator/default.nix
+++ b/pkgs/development/python-modules/types-decorator/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "types-decorator";
-  version = "5.1.2";
+  version = "5.1.3";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "b3dd9027af1131b4e55ccd09248b7accc7a02d567139e2009ed20db13cf90600";
+    sha256 = "15d859bec0adca9edd948e94a5773c32710ee5dd4ad14ec983f08f979a821610";
  };

  # Modules doesn't have tests
--- a/pkgs/development/python-modules/types-protobuf/default.nix
+++ b/pkgs/development/python-modules/types-protobuf/default.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "types-protobuf";
-  version = "3.18.3";
+  version = "3.18.4";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "d3e253ebc1ba5e78932fef703dc4316afb7e5facd0ce8661b3921c9d541e16a7";
+    sha256 = "2aed45e5257e9adebce306637179bfa111d42ecdd523e2a13d30cf8b2ee3cc84";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "types-requests";
-  version = "2.27.0";
+  version = "2.27.2";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-vFztDc8GdOPx+d7XNM7p+kXFfPZEsInmLI+xLKKOshU=";
+    sha256 = "c902c5433ad103053011c6ac036317ac6f6a8e8a6926fc470a8d2ef791236da7";
  };

  # Module doesn't have tests
--- a/pkgs/development/python-modules/types-toml/default.nix
+++ b/pkgs/development/python-modules/types-toml/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "types-toml";
-  version = "0.10.1";
+  version = "0.10.2";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1jqh0vki1hccj391gnxpblim429sj56npgq2z749f8v9ay6qy7sw";
+    sha256 = "cd38b802e9c84c7a2e9b61e99a217e794bc01874586b292222e9764c6c7ca75c";
  };

  # Module doesn't have tests
--- a/pkgs/development/python-modules/urlextract/default.nix
+++ b/pkgs/development/python-modules/urlextract/default.nix
@ -1,27 +1,31 @@
 { lib
-, appdirs
 , buildPythonPackage
 , dnspython
 , fetchPypi
 , filelock
 , idna
+, platformdirs
 , pytestCheckHook
+, pythonOlder
 , uritools
 }:

 buildPythonPackage rec {
  pname = "urlextract";
-  version = "1.4.0";
+  version = "1.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "669f07192584b841b49ba8868fbd6b00e7ddc28367d36a3d8ca8c8e429420748";
+    hash = "sha256-QKXIQ9HXJTdY9W8NZ0jF6iekoUVl46kvJakW3cTB5B8=";
  };

  propagatedBuildInputs = [
-    appdirs
    filelock
    idna
+    platformdirs
    uritools
  ];

@ -39,7 +43,9 @@ buildPythonPackage rec {
    "test_dns_cache_reuse"
  ];

-  pythonImportsCheck = [ "urlextract" ];
+  pythonImportsCheck = [
+    "urlextract"
+  ];

  meta = with lib; {
    description = "Collects and extracts URLs from given text";
--- a/pkgs/development/tools/kubepug/default.nix
+++ b/pkgs/development/tools/kubepug/default.nix
@ -1,23 +1,25 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGo117Module, fetchFromGitHub }:

-buildGoModule rec {
+buildGo117Module rec {
  pname = "kubepug";
-  version = "1.2.2";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "rikatz";
    repo = "kubepug";
    rev = "v${version}";
-    sha256 = "sha256-jQ/LzwxYxfCKiu+2VhjQ3YWwLEqZkYrH7+olBOMUA1A=";
+    sha256 = "sha256-cjL718xTgtYev/lYL24vwZcB+joY3wIY4ixRCwAHQ4E=";
  };

-  vendorSha256 = "sha256-P5HoU9AAGFrSrp9iymjW+r8w5L90KUOrmaXM8p+Wn44=";
+  vendorSha256 = "0hynxj3q4aa1gx3w4ak56z6j5iplxi2hzqzsjkgz20fy34nfd41s";

  ldflags = [
    "-s" "-w" "-X=github.com/rikatz/kubepug/version.Version=${src.rev}"
  ];

-  subPackages = [ "cmd/kubepug.go" ];
+  patches = [
+    ./skip-external-network-tests.patch
+  ];

  meta = with lib; {
    description = "Checks a Kubernetes cluster for objects using deprecated API versions";
--- a/pkgs/development/tools/kubepug/skip-external-network-tests.patch
+++ b/pkgs/development/tools/kubepug/skip-external-network-tests.patch
@ -0,0 +1,12 @@
+diff --git a/pkg/utils/downloader_test.go b/pkg/utils/downloader_test.go
+index b227760..b72dee9 100644
+--- a/pkg/utils/downloader_test.go
+++ b/pkg/utils/downloader_test.go
+@@ -7,6 +7,7 @@ import (
+ )
+ 
+ func TestDownloadSwaggerFile(t *testing.T) {
+    t.Skipf("Nix sandbox does not have networking")
+ 	var tmpdir string
+ 	// Github actions does not have a temporary dir :/
+ 	tmpdir = os.Getenv("RUNNER_TEMP")
--- a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-llvm-lines";
-  version = "0.4.12";
+  version = "0.4.13";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = pname;
    rev = version;
-    sha256 = "sha256-D4blt8kGD0mxysedRMZo/VNfwfYdJs8T2zoNjHRi0ng=";
+    sha256 = "sha256-sN0i2oo0XuxneIK/w+jpxkcdm2rtqhyH2Y3CMPnH+ro=";
  };

-  cargoSha256 = "sha256-H2APBu9oHmtRGSB+VQT9V5C36awPy8fi6A2Qf1RsIbU=";
+  cargoSha256 = "sha256-Gv7C4NFThNawhT+IYO0ZbpOh6w/yPeIJKZjzTyM/GJw=";

  meta = with lib; {
    description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@ -352,6 +352,26 @@ in {
    filesToInstall = ["u-boot.bin"];
  };

+  ubootQemuX86 = buildUBoot {
+    defconfig = "qemu-x86_defconfig";
+    extraConfig = ''
+      CONFIG_USB_UHCI_HCD=y
+      CONFIG_USB_EHCI_HCD=y
+      CONFIG_USB_EHCI_GENERIC=y
+      CONFIG_USB_XHCI_HCD=y
+    '';
+    extraPatches = [
+      # https://patchwork.ozlabs.org/project/uboot/list/?series=268007&state=%2A&archive=both
+      # Remove when upgrading to 2022.01
+      (fetchpatch {
+        url = "https://patchwork.ozlabs.org/series/268007/mbox/";
+        sha256 = "sha256-xn4Q959dgoB63zlmJepI41AXAf1kCycIGcmu4IIVjmE=";
+      })
+    ];
+    extraMeta.platforms = [ "i686-linux" "x86_64-linux" ];
+    filesToInstall = [ "u-boot.rom" ];
+  };
+
  ubootRaspberryPi = buildUBoot {
    defconfig = "rpi_defconfig";
    extraMeta.platforms = ["armv6l-linux"];
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@ -1285,11 +1285,16 @@ let
        mktplcRef = {
          name = "color-highlight";
          publisher = "naumovs";
-          version = "2.3.0";
-          sha256 = "1syzf43ws343z911fnhrlbzbx70gdn930q67yqkf6g0mj8lf2za2";
+          version = "2.5.0";
+          sha256 = "sha256-dYMDV84LEGXUjt/fbsSy3BVM5SsBHcPaDDll8KjPIWY=";
        };
-        meta = {
-          license = lib.licenses.mit;
+        meta = with lib; {
+          changelog = "https://marketplace.visualstudio.com/items/naumovs.color-highlight/changelog";
+          description = "Highlight web colors in your editor";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=naumovs.color-highlight";
+          homepage = "https://github.com/enyancc/vscode-ext-color-highlight";
+          license = licenses.gpl3Only;
+          maintainers = with maintainers; [ datafoo ];
        };
      };

--- a/pkgs/misc/vscode-extensions/terraform/default.nix
+++ b/pkgs/misc/vscode-extensions/terraform/default.nix
@ -3,8 +3,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
  mktplcRef = {
    name = "terraform";
    publisher = "hashicorp";
-    version = "2.17.0";
-    sha256 = "sha256-IZlw1lYibbBw3rcSiWEKP8rObxnMCE1ppogwmigNgwE=";
+    version = "2.18.0";
+    sha256 = "sha256-jQ4fwsAwuGDbfSb/qCV58ETtH+2e7zD/jGISGNYPxZk=";
  };

  patches = [ ./fix-terraform-ls.patch ];
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,22 +2,22 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.260-hardened1.patch",
-            "sha256": "13r6lx3rcbaz2wvhwa950gsjharzq1n61bl9l3nm8v66j7gab3l0",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.260-hardened1/linux-hardened-4.14.260-hardened1.patch"
+            "name": "linux-hardened-4.14.261-hardened1.patch",
+            "sha256": "0m5bb9lpaxw1kq01s9hqsxkmmsyj4ag8s5swrgdca1cf6q84r7bb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.261-hardened1/linux-hardened-4.14.261-hardened1.patch"
        },
-        "sha256": "1bylxn6hsq17cann2w02ggz6xz3b3synrapcwlwfcfydf71hzj9f",
-        "version": "4.14.260"
+        "sha256": "08s7idxpsjb29ccj0gkrj87xhbdqj9nc417qc7gd2kmbjd6amymz",
+        "version": "4.14.261"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.223-hardened1.patch",
-            "sha256": "1jrg8fkb8kc3m1zcgyw99mnmgvyxi3yp33x9jh1s4babxcr7w4g3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.223-hardened1/linux-hardened-4.19.223-hardened1.patch"
+            "name": "linux-hardened-4.19.224-hardened1.patch",
+            "sha256": "0sma7hwznyf8h3fr7r63nbfb85120nz8xq95ynp6m0lxayj5alxs",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.224-hardened1/linux-hardened-4.19.224-hardened1.patch"
        },
-        "sha256": "1cnjk49g8sxsbzk375ji47lnx36drqh1x2pbfiqdwgrbjcb043sz",
-        "version": "4.19.223"
+        "sha256": "0c8h457n52qzpw4kgr16ndhsl35si99amc6fadb31fy32csgrk01",
+        "version": "4.19.224"
    },
    "5.10": {
        "patch": {
@ -42,11 +42,11 @@
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.169-hardened1.patch",
-            "sha256": "19mghwh66rmbjd7i0hxhysabarpz8l4wadw8schwc8q9kxy33py4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.169-hardened1/linux-hardened-5.4.169-hardened1.patch"
+            "name": "linux-hardened-5.4.170-hardened1.patch",
+            "sha256": "0sy1114vw8lrbf4a1p3skg67am1f9bvl15d81mplx2bd98cpx0y8",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.170-hardened1/linux-hardened-5.4.170-hardened1.patch"
        },
-        "sha256": "068sw1p50vcygi422bfjpahf2fxy3ifyp4ljnkwxbbvibzcq4hsm",
-        "version": "5.4.169"
+        "sha256": "0b1qdmp2q0lpngfvvnwb248cnqn9akk2z4xawrfwziszrzh797xh",
+        "version": "5.4.170"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.14.260";
+  version = "4.14.261";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1bylxn6hsq17cann2w02ggz6xz3b3synrapcwlwfcfydf71hzj9f";
+    sha256 = "08s7idxpsjb29ccj0gkrj87xhbdqj9nc417qc7gd2kmbjd6amymz";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "4.19.223";
+  version = "4.19.224";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1cnjk49g8sxsbzk375ji47lnx36drqh1x2pbfiqdwgrbjcb043sz";
+    sha256 = "0c8h457n52qzpw4kgr16ndhsl35si99amc6fadb31fy32csgrk01";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:

 buildLinux (args // rec {
-  version = "4.4.297";
+  version = "4.4.298";
  extraMeta.branch = "4.4";
  extraMeta.broken = stdenv.isAarch64;

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "116346nkbhaz8jc1118gh40y6pw1kq7c7hm74f8bjga1p0gjqn0c";
+    sha256 = "1q56ch8p53in5rl5i7mvsyf0jimchrh48w3l416x3yi0n5cyvjc6";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:

 buildLinux (args // rec {
-  version = "4.9.295";
+  version = "4.9.296";
  extraMeta.branch = "4.9";
  extraMeta.broken = stdenv.isAarch64;

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "095am71hl7qryrcn1blvxsq5zsy0gixmj7062p7vvz5ypcvqcd52";
+    sha256 = "1a5ws21dk5wp397zmd7msl4zbhzm2xxgbxd09wrdcwilpv4dnjzx";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.10.89";
+  version = "5.10.90";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0c5v8fsv9sazdmdw4m1canm54x2p8777yavxq2gcpw8q98d8n8cj";
+    sha256 = "0997ijkmvf9iz4hn8m8naiagphhyvl4r6qx4q3gxk8qlq1j44pll";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.12";
+  version = "5.15.13";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "182iwy2288layl2290cxla0k6y436lxlx43yaa8par325dviksbx";
+    sha256 = "0shmrx33crnhi0wr5v6ly85pza1mmdcm8arkrdzf6plz5xm1n4qa";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.4.169";
+  version = "5.4.170";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "068sw1p50vcygi422bfjpahf2fxy3ifyp4ljnkwxbbvibzcq4hsm";
+    sha256 = "0b1qdmp2q0lpngfvvnwb248cnqn9akk2z4xawrfwziszrzh797xh";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "5.10.87-rt59"; # updated by ./update-rt.sh
+  version = "5.10.90-rt60"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -18,14 +18,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0jz6xhph7x0x11cjmypaw5gh8z4d53dcgx2gmg7k6d06ydq8n4h3";
+    sha256 = "0997ijkmvf9iz4hn8m8naiagphhyvl4r6qx4q3gxk8qlq1j44pll";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "04sr3n3ilvqq0dl59l92qmn3p7fjlsxxvbs3qls7b4pncb2xyyj3";
+      sha256 = "0533s01ckjjw45b08zs9nhpszdcrqgfpwvnjs2dfjmc6yg9d13pi";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@ -3,7 +3,6 @@
 , coreutils
 , gnused
 , gnugrep
-, jq
 , nix
 , lib
 }:
@ -19,5 +18,5 @@ substituteAll {
  nix_x86_64_linux = fallback.x86_64-linux;
  nix_i686_linux = fallback.i686-linux;
  nix_aarch64_linux = fallback.aarch64-linux;
-  path = lib.makeBinPath [ coreutils jq gnused gnugrep ];
+  path = lib.makeBinPath [ coreutils gnused gnugrep ];
 }
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@ -343,11 +343,6 @@ if [[ -n $flake ]]; then
    fi
 fi

-# Resolve the flake.
-if [[ -n $flake ]]; then
-    flake=$(nix "${flakeFlags[@]}" flake metadata --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
-fi
-
 # Find configuration.nix and open editor instead of building.
 if [ "$action" = edit ]; then
    if [[ -z $flake ]]; then
--- a/pkgs/servers/etcd/default.nix
+++ b/pkgs/servers/etcd/default.nix
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "wordpress";
-  version = "5.8.2";
+  version = "5.8.3";

  src = fetchurl {
    url = "https://wordpress.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-o9KeTmZXTHtqa/Z2KOo1n6gVCFuna42dFrvf9OBC8v8=";
+    sha256 = "sha256-1OuhoP+QRZrbdThI/npWbOchLR3MnrH7+lFRf5oVPaU=";
  };

  installPhase = ''
--- a/pkgs/tools/misc/dialog/default.nix
+++ b/pkgs/tools/misc/dialog/default.nix
@ -8,7 +8,7 @@
 }:

 assert withLibrary -> libtool != null;
-assert unicodeSupport -> ncurses.unicode && ncurses != null;
+assert unicodeSupport -> ncurses.unicodeSupport && ncurses != null;

 stdenv.mkDerivation rec {
  pname = "dialog";
--- a/pkgs/tools/misc/spigot/default.nix
+++ b/pkgs/tools/misc/spigot/default.nix
@ -1,36 +1,54 @@
 { lib
 , stdenv
-, buildPackages
-, fetchgit
-, autoreconfHook
+, fetchurl
+, cmake
 , gmp
-, ncurses
 , halibut
+, ncurses
 , perl
 }:

 stdenv.mkDerivation rec {
  pname = "spigot";
-  version = "20200901";
-  src = fetchgit {
-    url = "https://git.tartarus.org/simon/spigot.git";
-    rev = "9910e5bdc203bae6b7bbe1ed4a93f13755c1cae";
-    sha256 = "1az6v9gk0g2k197lr288nmr9jv20bvgc508vn9ic3v7mav7hf5bf";
+  version = "20210527";
+  srcVersion = "20210527.7dd3cfd";
+
+  src = fetchurl {
+    url = "https://www.chiark.greenend.org.uk/~sgtatham/spigot/${pname}-${srcVersion}.tar.gz";
+    hash = "sha256-EBS3lgfLtsyBQ8mzoJPyZhRBJNmkVSeF5XecGgcvqtw=";
  };

-  nativeBuildInputs = [ autoreconfHook halibut perl ];
+  nativeBuildInputs = [
+    cmake
+    halibut
+    perl
+  ];

-  configureFlags = [ "--with-gmp" ];
+  buildInputs = [
+    gmp
+    ncurses
+  ];

-  buildInputs = [ gmp ncurses ];
+  outputs = [ "out" "man" ];

  strictDeps = true;

+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    [ `$out/bin/spigot -b 10 -d 10 e` == "2.7182818284" ] || exit 1
+    [ `$out/bin/spigot -b 10 -d 10 pi` == "3.1415926535" ] || exit 1
+    [ `$out/bin/spigot -b 10 -d 10 sqrt\(2\)` == "1.4142135623" ] || exit 1
+
+    runHook postInstallCheck
+  '';
+
  meta = with lib; {
-    description = "A command-line exact real calculator";
    homepage = "https://www.chiark.greenend.org.uk/~sgtatham/spigot/";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    maintainers = with maintainers; [ mcbeth ];
+    description = "A command-line exact real calculator";
+    license = licenses.mit;
+    maintainers = with maintainers; [ AndersonTorres mcbeth ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "exploitdb";
-  version = "2021-12-21";
+  version = "2022-01-06";

  src = fetchFromGitHub {
    owner = "offensive-security";
    repo = pname;
    rev = version;
-    sha256 = "sha256-HTs8dGDSYU/Ih/8CS+4C4AtERxQHwlmpfrA0YrrKoyY=";
+    sha256 = "sha256-SvzrUVuOzqcc4YzBYxuE8S0tFNb2Pr2FEj8KSpuKKGU=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "gitleaks";
-  version = "8.2.5";
+  version = "8.2.7";

  src = fetchFromGitHub {
    owner = "zricethezav";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-lHKdIQyGbQt6PmMaTRIUx1q/81Q4KOfQ8zLnpt9aGbk=";
+    sha256 = "sha256-kCKkPx0JEzmQn0y6UbVuwZXre7rDd4vKTudh6J3AxYA=";
  };

-  vendorSha256 = "sha256-cIwte59AdVOWMBUWE4gKZSHhU37HgEW4k0v+jUUyj1Q=";
+  vendorSha256 = "sha256-zJ9Xl4tRUWntQwco+EHzqmL1aVcOjp70LCCmRsboxQ4=";

  ldflags = [
    "-s"
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.22"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.23"
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@ -1,9 +1,9 @@
 GIT
  remote: https://github.com/rapid7/metasploit-framework
-  revision: 3bfd2d8eeab3f8ab7efd7a46f8125a7a3bb5f2f0
-  ref: refs/tags/6.1.22
+  revision: 7682d9ab9c404b55cfc4a221db22f74a740a6f7f
+  ref: refs/tags/6.1.23
  specs:
-    metasploit-framework (6.1.22)
+    metasploit-framework (6.1.23)
      actionpack (~> 6.0)
      activerecord (~> 6.0)
      activesupport (~> 6.0)
@ -75,7 +75,7 @@ GIT
      rex-text
      rex-zip
      ruby-macho
-      ruby_smb (~> 2.0)
+      ruby_smb (~> 3.0)
      rubyntlm
      rubyzip
      sinatra
@ -128,13 +128,13 @@ GEM
    arel-helpers (2.14.0)
      activerecord (>= 3.1.0, < 8)
    aws-eventstream (1.2.0)
-    aws-partitions (1.543.0)
-    aws-sdk-core (3.125.0)
+    aws-partitions (1.547.0)
+    aws-sdk-core (3.125.1)
      aws-eventstream (~> 1, >= 1.0.2)
      aws-partitions (~> 1, >= 1.525.0)
      aws-sigv4 (~> 1.1)
      jmespath (~> 1.0)
-    aws-sdk-ec2 (1.288.0)
+    aws-sdk-ec2 (1.290.0)
      aws-sdk-core (~> 3, >= 3.125.0)
      aws-sigv4 (~> 1.1)
    aws-sdk-iam (1.65.0)
@ -143,7 +143,7 @@ GEM
    aws-sdk-kms (1.53.0)
      aws-sdk-core (~> 3, >= 3.125.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.110.0)
+    aws-sdk-s3 (1.111.1)
      aws-sdk-core (~> 3, >= 3.125.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.4)
@ -175,25 +175,29 @@ GEM
    eventmachine (1.2.7)
    faker (2.19.0)
      i18n (>= 1.6, < 2)
-    faraday (1.8.0)
+    faraday (1.9.3)
      faraday-em_http (~> 1.0)
      faraday-em_synchrony (~> 1.0)
      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
+      faraday-net_http_persistent (~> 1.0)
      faraday-patron (~> 1.0)
      faraday-rack (~> 1.0)
-      multipart-post (>= 1.2, < 3)
+      faraday-retry (~> 1.0)
      ruby2_keywords (>= 0.0.4)
    faraday-em_http (1.0.0)
    faraday-em_synchrony (1.0.0)
    faraday-excon (1.1.0)
    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.2)
+      multipart-post (>= 1.2, < 3)
    faraday-net_http (1.0.1)
    faraday-net_http_persistent (1.2.0)
    faraday-patron (1.0.0)
    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
    faye-websocket (0.11.1)
      eventmachine (>= 0.12.0)
      websocket-driver (>= 0.5.1)
@ -260,7 +264,7 @@ GEM
      webrick
    metasploit_payloads-mettle (1.0.17)
    method_source (1.0.0)
-    mini_portile2 (2.6.1)
+    mini_portile2 (2.7.1)
    minitest (5.15.0)
    mqtt (0.5.0)
    msgpack (1.4.2)
@ -274,8 +278,8 @@ GEM
    network_interface (0.0.2)
    nexpose (7.3.0)
    nio4r (2.5.8)
-    nokogiri (1.12.5)
-      mini_portile2 (~> 2.6.1)
+    nokogiri (1.13.0)
+      mini_portile2 (~> 2.7.0)
      racc (~> 1.4)
    nori (2.6.0)
    octokit (4.21.0)
@ -375,7 +379,7 @@ GEM
    ruby-macho (2.5.1)
    ruby-rc4 (0.1.5)
    ruby2_keywords (0.0.5)
-    ruby_smb (2.0.13)
+    ruby_smb (3.0.0)
      bindata
      openssl-ccm
      openssl-cmac
@ -400,7 +404,7 @@ GEM
      daemons (~> 1.0, >= 1.0.9)
      eventmachine (~> 1.0, >= 1.0.4)
      rack (>= 1, < 3)
-    thor (1.1.0)
+    thor (1.2.1)
    tilt (2.0.10)
    ttfunk (1.7.0)
    tzinfo (2.0.4)
--- a/Show More
+++ b/Show More